Skip to content

Commit 4e7a991

Browse files
RealOrangeOnenessita
authored andcommitted
Refs #36588 -- Warned about using external templates in startapp/startproject commands.
Clarified that custom templates provided via `--template` for `starapp` and `startproject` are used as-is, adding a warning that malicious or poorly constructed templates may introduce security issues.
1 parent c595af6 commit 4e7a991

1 file changed

Lines changed: 13 additions & 1 deletion

File tree

docs/ref/django-admin.txt

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1319,6 +1319,15 @@ zip files, you can use a URL like:
13191319

13201320
django-admin startapp --template=https://github.com/githubuser/django-app-template/archive/main.zip myapp
13211321

1322+
.. warning::
1323+
1324+
Templates provided via ``--template`` are used as is. Malicious or poorly
1325+
constructed templates may introduce security weaknesses or unintended
1326+
behavior. Compressed archives may also consume excessive resources during
1327+
extraction, potentially causing crashes or hangs.
1328+
1329+
Contents of templates should be carefully inspected before use.
1330+
13221331
.. django-admin-option:: --extension EXTENSIONS, -e EXTENSIONS
13231332

13241333
Specifies which file extensions in the app template should be rendered with the
@@ -1412,7 +1421,10 @@ For example:
14121421
.. django-admin-option:: --template TEMPLATE
14131422

14141423
Specifies a directory, file path, or URL of a custom project template. See the
1415-
:option:`startapp --template` documentation for examples and usage.
1424+
:option:`startapp --template` documentation for examples and usage. The same
1425+
**security considerations** described for ``startapp`` templates apply here:
1426+
malicious or poorly constructed templates may introduce weaknesses or consume
1427+
excessive resources, and templates should be carefully inspected before use.
14161428

14171429
.. django-admin-option:: --extension EXTENSIONS, -e EXTENSIONS
14181430

0 commit comments

Comments
 (0)